Prototype Pollution

Vulnerability

The nconf package before version 0.11.4 is vulnerable to Prototype Pollution when using the memory engine [1][2]. The .set() function, responsible for setting configuration properties, does not adequately sanitize user-supplied property names, allowing an attacker to supply a crafted property such as __proto__ or constructor.prototype to pollute the Object prototype [2][4].

Exploitation

An attacker can exploit this vulnerability by calling the .set() function with a malicious property path that targets the object's prototype (e.g., nconf.set('__proto__.polluted', 'true')) [2][4]. No authentication is required if the attacker can control the input to .set(); however, exploitation typically requires the attacker to have some means of injecting the crafted key-value pair into the configuration process [2].

Impact

Successful prototype pollution can lead to the modification of properties on Object.prototype, which are inherited by all JavaScript objects in the application [4]. This can result in denial of service (e.g., by polluting a property that causes exceptions) or potentially remote code execution if the polluted property influences application behavior in a dangerous way [4]. The scope of impact depends on the application's usage of the polluted properties.

Mitigation

The vulnerability is fixed in nconf version 0.11.4, released on 2020-10-19 [1][3]. The fix was implemented in pull request #397, which sanitizes keys passed to the memory engine's .set() function [3]. Users should upgrade to 0.11.4 or later. There is no known workaround for earlier versions [2].